Google推工具軟體 踩微軟地盤

原文

網路搜尋引擎業者Google上個月推出企業工具軟體產品，Google台灣工程研究所所長簡立峰表示，該項服務也同步在台灣上市，鎖定的客戶為大學與企業，目前已經有不少國內企業成為試用對象。企業工具軟體為收費服務，每位員工可使用十G的網路空間，同時擁有試算表、辦公室文書處理軟體、郵件等等工具軟體，平均一位員工的年費為五十美元（約新台幣一千六百元）。

Google進軍企業軟體市場，將對軟體龍頭業者微軟造成巨大的威脅。因為微軟不論是在個人電腦的作業系統，或是辦公室文書處理軟體，市佔率都是第一名。但Google的企業工具軟體，並不是以套裝產品的形式銷售，而是以網路服務的模式提供；雖然微軟針對企業客戶也有大量授權使用的銷售模式，但是運用的環境還是必須安裝在個人電腦上才能使用。Google與微軟的企業軟體，雙方最大的差異在於價格及使用環境。Google軟體工具的使用前提是必須要在網路環境，但微軟並沒此前提，就價格來說，Google產品僅微軟的十分之一。

根據外電報導，Google這項針對企業用戶的Google Apps-Premier Edition的套裝工具軟體，每位員工收費五十美元。

業界仍從許多面向來解讀Google此項服務對業界所帶來的影響；首先，打破了企業工具軟體通常是安裝在個人電腦的刻版印象。也挑戰了既有商用軟體大廠行之有年的遊戲規則。

2006年IE有284天是不安全的

Internet Explorer Unsafe for 284 Days in 2006

原文

Security Fix spent the past several weeks compiling statistics on how long it took some of the major software vendors to issue patches for security flaws in their products. Since Windows is the most-used operating system in the world, it makes sense to lead off with data on Microsoft's security updates in 2006.


Click the graphic for data on 2006 IE patches.







First, a note on the methodology behind this blog post: The data presented here builds on
a project I began in late 2005 looking back on three years of efforts by Microsoft to address only the most severe security holes in its software. I conducted that same research again last month, individually contacting nearly all of the security researchers who submitted reports of critical flaws in Microsoft products to learn from them not only the dates that they had submitted their findings to the company, but also any other security trends or anomalies they observed in working with the world's largest software maker.

Several weeks prior to posting this information, I shared the data I had gathered with Microsoft. The officials I dealt with helpfully concurred or quibbled slightly with some of my findings, but the company raised no objections that would materially affect the results presented in this particular study of IE flaws. In fact, if you examine the links included in
the vulnerability chart that accompanies this post, you can see for yourself how the data is supported by information posted on the Web over the past year.

Patching Internet Explorer in 2006

For all its touted security improvements, the release of Microsoft's new
Internet Explorer 7 browser in November came too late in the year to improve the lot of IE users, who make up roughly 80 percent of the world's online community. For a total 284 days in 2006 (or more than nine months out of the year), exploit code for known, unpatched critical flaws in pre-IE7 versions of the browser was publicly available on the Internet. Likewise, there were at least 98 days last year in which no software fixes from Microsoft were available to fix IE flaws that criminals were actively using to steal personal and financial data from users.

In a total of ten cases last year, instructions detailing how to leverage "critical" vulnerabilities in IE were published online before Microsoft had a patch to fix them.


Microsoft labels software vulnerabilities "critical" -- its most severe rating -- if the flaws could be exploited to criminal advantage without any action on the part of the user, or by merely convincing an IE user to click on a link, visit a malicious Web site, or open a specially crafted e-mail or e-mail attachment.

[The chart posted here shows the overlap of threats from various IE flaws throughout the year.]


In contrast, Internet Explorer's closest competitor in terms of market share -- Mozilla's Firefox browser -- experienced
a single period lasting just nine days last year in which exploit code for a serious security hole was posted online before Mozilla shipped a patch to remedy the problem.

Criminals specializing in Internet fraud continued to ply much of their trade with the aid of security flaws in the Microsoft browser last year. In 2006, the company issued patches to fix a total of four "
zero-day" flaws in IE. Zero-day (or 0day) attacks are so named because software vendors have no time to develop a fix for the flaws before they are exploited by cyber crooks for financial or personal gain.

The first major flaw in a Windows program last year involved
one that could be easily exploited via Internet Explorer. In late December 2005, experts tracked organized criminals hacking into sites and seeding them with code that installed password-stealing spyware on machines used by anyone who merely visited the sites with IE. Microsoft initially downplayed the severity of the attacks, until it became clear that the threat was fairly widespread and that thousands of customers had already been attacked in the span of a few days. The threat was seen as so severe that a large number of security experts urged users to download and install a patch produced by a third party until Microsoft developed an official fix.

In September, attackers would exploit an unpatched flaw in non-Microsoft Web server software to
install malicious code on thousands of legitimate Web sites that could infect Windows machines when users merely browsed the sites with IE. Much like the IE flaw first detected in December 2005, this sophisticated attack by organized criminals also would prompt a series of third-party security patches in the days before Microsoft issued an official update.

Check back with Security Fix on Friday for a look at the number of vulnerabilities that Microsoft patched in its Office applications last year.

聊天的好處? 微軟的公益計畫

原文

眼尖的MSN用戶可能發現，越來越多的朋友在MSN暱稱前面出現一個綠色的「I'm」符號，大家眾說紛紜，起先說這是一個隱藏的表情符號，有關於微軟的公益計畫，之後又傳出可能是一個病毒，台灣微軟方面表示，這的確是一個慈善活動，大家聊天聊越多，公益團體所獲得的捐贈就越多，未來，台灣地區也有可能加入這樣的計畫。

許多人當初以為這個綠色的「I'm」是微軟新推「隱藏版」表情符號，興高采烈地放在MSN暱稱的前面，正好變成「I'm 某某某（姓名）」，台灣微軟MSN部門行銷經理鍾婉珍表示，這是一個在美國推出的公益捐助計畫，在Windows Live Messenger 8.1版（8.1版本前均不支援）暱稱上輸入一串「特定碼」，MSN暱稱除了出現「I'm」符號之外，微軟將按照訊息量，拆分一定比例的廣告營收捐贈給代碼所表示的慈善機構，在第一年每個機構的捐款下限是十萬美元，聊越多微軟也將捐贈的越多，由於這個計畫是在美國實行，捐贈的對象將是美國慈善團體，而且限定對話的雙方必須有一方是在美國網站註冊的用戶。

目前受贈機構包括

American Red Cross（美國紅十字會，特定碼*red+u）、
Boys & Girls Club（兒童群益會，特定碼*bgca）、
National AIDS Fund（美國國家愛滋基金，特定碼*naf）、
National Multiple Sclerosis Society（國家多發性硬化症學會，特定碼*mssoc）、
ninemillion.org（國際兒童難民援助組織，特定碼*9mil）、
Sierra Club 山巒協會（保護自然生態的地球環境協會，特定碼*sierra）、
StopGlobalWarming.org（防止全球溫室效應惡化的機構，特定碼*help） 、
Susan G. Komen for the Cure（乳癌基金會，特定碼*komen） 、
The US fund for UNICEF（美國地區聯合國兒童基金會，特定碼*unicef）、
World Wildlife Fund for Nature（世界自然基金會，特定碼*wwf）、
The Oxford Committee for Famine Relief （樂施會；協助解決當時世界各地饑荒及貧窮問題，特定碼*oxfam）、
國際關懷協會（特定碼*care）、
The Humane Society of the United States（美國人道協會，特定碼*hsus）、
American Cancer Society（美國癌症協會，特定碼*acs）、
ONE Campaign-（全球消除貧困與對抗愛滋的組織(GCAP)，特定碼*one）

鍾婉珍說，這個計畫在美國3月1日正式實施，未來將視成果來決定是否推行到其他地區，所以，如果效果不錯，將有可能把這個捐贈計畫移植到台灣。

鍾婉珍強調，網路謠傳這是一個病毒，是錯誤的資訊，任意改變暱稱是不會中毒的。

相關說明：http://im.live.com/Messenger/IM/Home/

無名小站Lavender717網友的Blog上也有